|
Documentation
General information, installation how-to, usage instructions and troubleshooting
Featured, Phase-Deploy, Phase-Support
Licencelogkeys is dual licensed under the terms of either GNU GPLv3 or later (required by Google), or WTFPLv2 or later. Pick whichever you prefer! InstallationIf you have ever installed a Linux program from source, then you should have no trouble installing logkeys. If you haven't installed from source yet, it is likely you are missing a C++ compiler installed. Before proceeding please ensure you have g++ and "similarly trivial tools" ready. $ sudo apt-get install g++ # to install g++ on a Debian-based OS Proceed with $ tar xvzf logkeys-0.1.1a.tar.gz # to extract the logkeys archive $ cd logkeys-0.1.1a/build # move to build directory to build there $ ../configure # invoke configure from parent directory $ make # make compiles what it needs to compile ( become superuser now ) # you need root to install in system dir $ make install # installs binaries, manuals and scripts If you run on any errors during configure stage, your machine must be in a very poor shape. Before installing please confirm that you have a 2.6 branch of Linux kernel, and standard command line utilities such as ps, grep, and especially dumpkeys. logkeys relies on dumpkeys to output at least half correct keysym bindings. For this to be true, you have to set your console keymap. If you have keyboard correctly set to your language in X, verify that the same characters appear on a virtual terminal (Ctrl+Alt+Fn) also. logkeys also relies on en_US.UTF-8 locale being present on the system, or any other language using UTF-8. You can confirm you are using UTF-8 locale, if you say $ locale -a C ... en_US.utf8 ... $ locale LANG=en_US.UTF-8 LC_CTYPE="en_US.UTF-8" ...If locale -a does not return among others the result en_US.UTF-8 and if LC_CTYPE environmental variable doesn't contain UTF-8, then logkeys may not work correctly. If that is the case use either locale-gen or install/reconfigure your distribution's locales package, and there include en_US.UTF-8. $ apropos locale
Usage how-tologkeys is simple. You can either invoke it directly, by typing full command line, or use the provided scripts. There are two helper programs in this package:
bin/llk runs etc/logkeys-start.sh, and bin/llkk runs etc/logkeys-kill.sh. You can use these two setuid root programs (llk and llkk) for starting and stopping the keylogger quickly and covertly. You can modify the two .sh scripts as you like. As the programs are installed with setuid bit set, the root password need not be provided at their runtime. Default log file is /var/log/logkeys.log and is not readable by others. I suggest you first test the program manually with $ touch test.log $ logkeys --start --output test.log and in the other terminal follow it with $ tail --follow test.log and see if the pressed keys match to those noted. If you use a US keyboard layout, use -u switch. Make sure your terminal character locale is set to UTF-8 $ locale LANG=xx_YY.UTF-8 LC_CTYPE="xx_YY.UTF-8" ... or alternatively, you need en_US.UTF-8 locale available on your system $ locale -a ... en_US.UTF-8 ... otherwise you may only see odd characters (like ꑶ etc.) when pressing character keys. logkeys acts as a daemon, and you stop the running logger process with $ logkeys --kill (or bin/llkk provided script). Before using logkeys, please read the manual page first. $ man logkeys Autorun at system startIf you want logkeys to autorun when your OS boots, you have several options. You can edit /etc/rc.local (or /etc/rc.d/rc.local) file and add logkeys execution line before the final exit 0 call, e.g. #!/bin/sh -e # # rc.local # logkeys --start --keymap=/home/I/custom_key.map --output=/home/I/custom.log --device=event4 exit 0 Alternatively, you can put your custom "logkeys execution line" into etc/logkeys-start.sh file, and then use your desktop's "autorun manager" to run llk program, which will then execute said logkeys-start.sh script without prompting you for root/sudo password. logkeys will automatically terminate on shutdown. TroubleshootingEmpty log file or 'Couldn't determine keyboard device' errorAfter you run logkeys successfully, if you open the log file and see only the 'Logging started...' and 'Logging stopped...' tag without any keypress "contents," it is very likely that logkeys got your device id wrong. This may also apply if you get the following error: logkeys: Couldn't determine keyboard device. :/
Logkeys outputs wrong charactersIt is very likely that you will see only some characters recognized, without any hope for Shift and AltGr working even slightly correct, especially when starting logkeys in X. In that case it is better to switch to virtual terminal, e.g. tty4 (Ctrl+Alt+F4), and there execute: $ logkeys --export-keymap=my_lang.map Then open my_lang.map in UTF-8 enabled text editor and manually repair any missing or incorrectly determined mappings. Character keys are defined with two to three space-delimited characters per line (first without modifiers, second with shift, third with AltGr), and function keys are strings of at most 7 characters. Make sure your customized keymap follows the logkeys keymap format specification! From then on, execute logkeys with --keymap switch, e.g. $ logkeys --start --keymap my_lang.map Again, see if it now works correctly (and character keys appear correct when you are viewing the log file in editor), and opt to modify bin/llk starter script. If you create full and completely valid keymap for your particular language, please upload it as a new issue or send it to me by e-mail. Thanks. Some languages may already have keymaps available. Known bugs and limitationsPlease report all found bugs on the issues tracking page. Planned features (roadmap)TODO file provided with release currently holds following demanded features:
If you have time on your hands and the required interest, you are welcome to hack at any of those or completely other features yourself. | ||
► Sign in to add a comment
If you are running Debian/Ubuntu and logkeys returns weird keys in the log, despite locale returning all en_US's, the run this to fix it:
Debian: su -c 'dpkg-reconfigure console-data' Ubuntu: sudo dpkg-reconfigure console-setup
Running for US keyboards
logkeys --start --us-keymap
Autorun at system start
sudo gedit /etc/init.d/logkeys-start
Paste this in there
#!/bin/bash
sudo logkeys --start --us-keymap
and save it
Run this
sudo su
cd
cd /etc/init.d/
update-rc.d logkeys-start defaults
chmod +x /etc/init.d/logkeys-start
reboot That's it
The log file will be the one that is at
sudo nano /var/log/logkeys.log
Works great on Ubuntu 10.04 LTS!
For automatic screenshots, I did the following.
For screenshots, ubuntu comes with the import command.
You need a script to run the screenshot command.
Add the following:
#!/bin/bash DATE="`date '+%Y%m%d_%H_%M'`" export DISPLAY=:0 /usr/bin/import -window root -resize 800 /var/log/ss/${DATE}.jpgAnd save. I used /var/log/ss to store the screen shots. Adjust the resolution as needed.
Make the script executable
Make the ss dir:
Next you need to edit root's crontab to run this script however often. I set it for every two minutes.
Edit cron:
Note: Choose an editor, like nano if prompted.
Add the following to the cron (all on one line):
Save and exit and crontab will be updated. To check root's crontab run:
Now you need a script to clean up old screenshots, so you you don't fill up your harddrive -- it would take you a long time to do that though.
For this I added a cron.daily script, so it gets run once a day. I set it to delete any image files older than 30 days.
Create the clean up script:
Add these lines to it:
#!/bin/bash cd /var/log/ss find . -name '*jpg' -mtime +30 -exec /bin/rm {} \;Save and exit
Make the script executable:
Done
Now to view these files you must have root permission. I like to use the run command (alt-F2) and enter the following at the run prompt.
To see the Screen Shots:
My log file shows this?
<LShft>rack<LShft>$!$(
is it Rack$!$( as typed?
No, I think had the user typed Rack, the log would say Rack.
apparently my system is 'in very poor condition' because i DO run into errors at the initial installation. everything goes fine until i start the 'make install' command. what happens next, is this:
Making install in src
make1?: Entering directory `/home/michelle/Downloads/logkeys-0.1.1a/build/src'
make2?: Entering directory `/home/michelle/Downloads/logkeys-0.1.1a/build/src'
test -z "/usr/local/bin" || /bin/mkdir -p "/usr/local/bin"
/usr/bin/install: cannot create regular file `/usr/local/bin/logkeys': Permission denied
/usr/bin/install: cannot create regular file `/usr/local/bin/llk': Permission denied
/usr/bin/install: cannot create regular file `/usr/local/bin/llkk': Permission denied
make2?: [install-binPROGRAMS] Error 1
make2?: Leaving directory `/home/michelle/Downloads/logkeys-0.1.1a/build/src'
make1?: [install-am] Error 2
make1?: Leaving directory `/home/michelle/Downloads/logkeys-0.1.1a/build/src'
make: [install-recursive] Error 1
michelle@michelle-asus:~/Downloads/logkeys-0.1.1a/build$
being a newbie, i have no clue what's going wrong... any suggestions are much appreciated!
in terminal, type
$ sudo make install
is it possible to run the screenshot command every time i click with my mouse and focus the screenshot just say 600x480 around tou mouse pointer?
How would one use the http post feature? Is it possible to, say, upload the file to a Dropbox account or some other web service?
Trying to make and every time i get the same error (tried w/ and w/o the sudo, as i am already root)
[root@cx-gtkeylog1 build]# pwd /root/logkeys-0.1.1a/build [root@cx-gtkeylog1 build]# ls config.h config.log config.status Makefile man scripts src stamp-h1 [root@cx-gtkeylog1 build]# [root@cx-gtkeylog1 build]# sudo make make all-recursive make1?: Entering directory `/root/logkeys-0.1.1a/build' Making all in src make2?: Entering directory `/root/logkeys-0.1.1a/build/src' g++ -DHAVE_CONFIG_H -I. -I../../src -I.. -Wall -O3 -DSYS_CONF_DIR=\"/usr/local/etc\" -MT logkeys.o -MD -MP -MF .deps/logkeys.Tpo -c -o logkeys.o ../../src/logkeys.cc In file included from ../../src/logkeys.cc:58: ../../src/args.cc:49:50: error: invalid suffix "b1" on integer constant ../../src/args.cc:50:50: error: invalid suffix "b10" on integer constant ../../src/args.cc:51:50: error: invalid suffix "b100" on integer constant ../../src/args.cc:52:50: error: invalid suffix "b1000" on integer constant ../../src/args.cc:53:50: error: invalid suffix "b10000" on integer constant ../../src/args.cc:54:50: error: invalid suffix "b100000" on integer constant ../../src/args.cc:76:16: error: invalid suffix "b1" on integer constant ../../src/args.cc:78:16: error: invalid suffix "b1000" on integer constant ../../src/args.cc:84:16: error: invalid suffix "b10000" on integer constant ../../src/args.cc:98:16: error: invalid suffix "b100000" on integer constant ../../src/logkeys.cc:370:37: error: invalid suffix "b1" on integer constant ../../src/logkeys.cc:384:51: error: invalid suffix "b1" on integer constant ../../src/logkeys.cc:388:61: error: invalid suffix "b1" on integer constant ../../src/logkeys.cc:393:23: error: invalid suffix "b1" on integer constant ../../src/logkeys.cc:459:20: error: invalid suffix "b100" on integer constant ../../src/logkeys.cc:523:27: error: invalid suffix "b10" on integer constant ../../src/logkeys.cc:537:26: error: invalid suffix "b100" on integer constant ../../src/logkeys.cc:577:28: error: invalid suffix "b10" on integer constant make2?: [logkeys.o] Error 1 make2?: Leaving directory `/root/logkeys-0.1.1a/build/src' make1?: [all-recursive] Error 1 make1?: Leaving directory `/root/logkeys-0.1.1a/build' make: all? Error 2
i'm new to linux/redhat, really a unix user, any suggestions would be great, thanks!
figured it out, look at https://code.google.com/p/logkeys/source/browse/trunk/src/args.cc?r=67#28
this is more of a question. I have had a lot of problems with malicious keyloggers. Is there any way to detect a keylogger on a Knoppix instalation?
Help is really appreciated! Yours, josh Denton chezashua@gmail.com
I am trying it with Fedora 15 but without any luck, I keep on getting empty log file, even when I specify the /input/eventX manually, any idea what can be the cause ?
I seem to have the same issue on Fedora 15, Logskeys seems to run without any obvious error but nothing gets logged.
Fedora 15 here. My log file is also empty. There is no sign of the program executing.
Don't compile the beta logkeys on Fedora 15, use the stable version. Then add these two lines to logkeys-0.1.0/src/logkeys.cc near the #include section:
#include <sys/types.h> #include <sys/stat.h>
Then compile as you normally would.
followed us instructions Wininc for Fedora15, but it seems that it only works if u add the -u option, otherwise it will just freeze
install location? I downloaded to my home folder, then had no problems with the install and make in the home folder. but it's not creating /var/log/logkeys.log file. did I install in the wrong location? how do I get the logkeys.log file to create?
I created the file using sudo nautilus as it did not create itself, worked OK.
thanks Wininc and tarek.t.. got it working with both ur suggestions..
I noticed that it doesn't record on screen keyboard entries, how can I set it?
Ummm... that's not how it works. :)
I used this map in ubuntu 12.04 with a US keyboard
<Esc> 1 ! 1 2 @ 3 # 4 $ 5 % 6 ^ 7 & 8 9 ( 9 0 ) 0 -
+
<BckSp> <Tab> q Q w W e E r R t T y Y u U i I o O p P [ { ] } <Enter> <LCtrl> a A s S d D f F g G h H j J k K l L ; : ; ' " ` ~ <LShft> \ | z Z x X c C v V b B n N m M , < , . > / ? <RShft> <KP> <LAlt> <CpsLk> <F1> <F2> <F3> <F4> <F5> <F6> <F7> <F8> <F9> <F10> <NumLk> <ScrLk> <KP7> <KP8> <KP9> <KP-> <KP4> <KP5> <KP6> <KP+> <KP1> <KP2> <KP3> <KP0> <KP.> Ĉ <F11> <F12> <KPEnt> <RCtrl> <KP/> <PrtSc> <AltGr> <Break> <Home> <Up> <PgUp> <Left> <Right> <End> <Down> <PgDn> <Ins> <Del> <Pause> <LMeta> <RMeta> <Menu>
Use this "/2 /usr/local/bin/screen.sh" instead of this "0,2,4,6,8,10,12,14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54,56,58 /usr/local/bin/screen.sh"
You can also swap the 2 out for another number. i.e. 5 for every 5 minutes.